Unaudited, unvetted, experimental. Do not use as a reference. AI-researched ratings that may be wrong; not advice or a statement of fact about any provider. Full disclaimer
Pending review. 1150 of 1150 ratings not yet checked by a human. Do not rely on unreviewed ratings.
Ratings apply to this deployment only. Treat them as unverified for other chains. Why this deployment: The Wirex One web app bundle (archived) sets companyName "Wirex One", calls the Wirex BaaS API and registers chain 8453; Wirex's BaaS repo (7dff6ea) names Base and production ContractRegistry 0xAFa697eb..., whose FundsManagement runs card debits (Card-Debit-POS). Reads pinned to Base block 52290735. Excluded: legacy Wirex Pay chain 31415 (not in the RPC list), Stellar, chain 5042.
Conversion. The token is sold for fiat when a payment is authorised.
Platform token. Issued by the provider or its own ecosystem. Its value and liquidity depend on that provider, which may also control supply.
Wirex's BaaS stack keeps every balance in two Wirex-issued wrapped tokens on Base: WUSD (USD) and WEUR (EUR). Deposits of USDC, USDT or EURC are bridged to Base and wrapped 1:1 into WUSD or WEUR; withdrawals unwrap WUSD to USDC and WEUR to EURC. Wirex also mints WUSD/WEUR directly for card refunds, incoming SEPA/ACH transfers, P2P and rewards, so the tokens are claims on Wirex rather than plain USDC/EURC wrappers. At card authorisation the FundsManagement executor debits WUSD or WEUR from the user's wallet to a FundsBuffer (CryptoOut), then Wirex settles to the card network in fiat (CardOut). Which of the two is debited follows the card and balance currency; no default is documented. Both tokens are upgradeable contracts controlled by Wirex.
Checked 2026-10-12
Evidence (4)3 verified · 1 documented
Verified
Wirex's BaaS repo describes the unified balance model, with all balances held as WUSD and WEUR on Base and USDC, USDT or EURC deposits wrapped into them 1:1.
checked 2026-10-12 · source unchanged at weekly re-read 2026-10-19
Censorship Resistance
Who can block valid use, and can users route around them?
0 FailsPillar rating: weakest of 5 1 of 5 Partial or better
What would raise this pillar
Admin pause or freeze powers reaching Weak: Role held by a multisig that misses one of those conditions (no timelock, undisclosed signers, bypass modules), or the constraints are documented only.
Settle without the provider reaching Weak: Partial (for example settle but not refund or withdraw), or documented only.
Can any privileged role stop, freeze, or block payments through the settlement contracts, and how is that role constrained? C1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
There is no pause flag, but there is a stronger power. A single oracle EOA, set in a registry whose owner and admin is one EOA, both decides and executes every debit from user wallets, and the Terms let Wirex block addresses. No multisig, no timelock, and it can target individual wallets. The Terms' statement that Wirex cannot move a user's assets does not match FundsManagement's oracle path.
Evidence (3)2 verified · 1 documented
Verified
ContractRegistry owner() and admin() both return 0x8b72904e3685448E6f890d65a15D2aA206C1e0ab, which has no code (EOA); contractByName("FundsManagementOracle") returns 0x467F3ACD346A3Aa56F612820367023B94dC73d3f, also an EOA.
FundsManagement (Sourcify match) processOutgoingTransaction (L293-L346) is onlyOracle and moves any amount of a token out of a named user wallet via executeFromExecutor; the oracle and admin addresses are read from the registry, which the owner EOA can repoint.
Can a payer or payee complete settlement by calling the public contracts directly, without the provider's API, signer, or relayer? C2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card payments settle through the issuer and card network offchain. The onchain debit can only be run by Wirex's oracle EOA. A user can withdraw their own tokens directly (see S4), but that is exit, not settlement.
Evidence (1)1 verified
Verified
A card purchase (OutgoingTransactionProcessed, transactionType "Card-Debit-POS", currency EUR) debited WUSD from wallet 0x7a55A64c4527A2fD8e423F4c0F684C14FDe774c1; 392 such events were emitted in the 200 blocks before 52290735, all through the onlyOracle path.
Does the payment flow require a relayer, paymaster, bundler, or API that only the provider runs? C3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Card debits need Wirex's API and oracle key, wallet signing goes through Privy, and user operations are sponsored by a Wirex paymaster. None of it is public or has a fallback. Closed, single-vendor.
Evidence (2)1 verified · 1 documented
Verified
The wallet example sends user operations through Wirex-run bundler and paymaster endpoints (bundler.wirexpay.com, paymaster.wirexpay.com).
Is the settlement layer free of address or geographic filtering, and is any filtering at the edge disclosed and avoidable? C4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
The contracts let the admin decide which user operations are allowed, and the Terms disclose address blocking for sanctions or risk policy, without naming a list. The filtering is disclosed in the Terms, and the settlement layer is not shown to be neutral, so 1.
Evidence (2)1 verified · 1 documented
Verified
ExecutionDelayPolicy classifies every user operation and rejects "Restricted" types (L118-L131, L355-L368); the classification follows admin-set registry entries and whitelists (setApprovedCall, onlyAdmin).
Are the tokens and chains the rail depends on enumerated, with their issuers' freeze powers and sequencer assumptions stated to payees? C5
2 Partial
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Tokens are enumerated onchain and in a versioned repo document. Users are not told about the issuers' freeze powers (Circle and Tether blacklists), Wirex's own control of the upgradeable WUSD/WEUR synthetics, or Base's centralized sequencer. Enumerated, assumptions not stated, so 2.
Evidence (2)2 verified
Verified
TokensRegistry retrieveAllTokensV2() lists USDC, USDT, DAI, EURC, OUSD, OEUR and the Wirex synthetics WUSD (base USDC) and WEUR (base EURC).
The repo doc enumerates the Base production tokens (USDC, USDT, EURC, WUSD, WEUR) with addresses; no file in the repo mentions issuer freeze or blacklist powers or Base's sequencer.
Does the deployed bytecode match public source, and can a third party rebuild it? O1
1 Weak
Best evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Most logic contracts are verified as partial matches, but the registry that routes every role and address is unverified, and so is one implementation. No build script is public. Some contracts verified, so 1.
Evidence (1)1 verified
Verified
Sourcify v2 gives exact_match for the Accounts, FundsManagement, ExecutionDelayPolicy, TokensRegistry and FundsBuffer proxies, and match (partial) for the FundsManagement, Accounts, ExecutionDelayPolicy and FundsBuffer implementations; the ContractRegistry 0xAFa697eb... and the TokensRegistry implementation 0x6098927a... have no Sourcify match.
Are the SDK, frontend, backend or API, indexer, and deploy scripts all public? O2
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Contract source is visible only through Sourcify verification. The app, API, oracle, indexer and SDK are closed. Contracts only, so 1.
Evidence (1)1 verified
Verified
The only Wirex repo for this stack is a set of agent skills (Markdown docs and tests) describing the BaaS REST API and contracts; the wirexapp and wirexpay orgs hold no SDK, app, backend or indexer source (wirexpay has forks of rundler, ultra-relay and Argo CD only).
Are ABIs, event schemas, an API schema, and a payee data export in a non-proprietary format all in the repo? O4
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Partial ABIs and prose API docs for BaaS integrators are in a repo. There is no machine-readable API schema, no ABI for the contracts that move funds, and no user data export. Judgment call: partial coverage fits "documented only" (1) better than 2.
Evidence (1)1 verified
Verified
ABI fragments for ContractRegistry, Accounts, TokensRegistry, Kernel and ERC20 only; nothing for FundsManagement, ExecutionDelayPolicy or FundsBuffer. The REST API is described in Markdown, with no OpenAPI file and no export format.
Do the SDK, widget, or frontend ship analytics, telemetry, error reporting, or fingerprinting? P1
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Error reporting, product analytics and tag management are on by default in the web app. The privacy policy discloses analytics only by category. Judgment call: category-level disclosure counts as "disclosed in docs" (1) rather than undisclosed (0); no trace was run.
Evidence (2)2 documented
Documented
The production web app bundle configures a Sentry DSN (ingest.de.sentry.io) and ships an Amplitude HTTP client, a Google Tag Manager loader and a GrowthBook client key.
What do calldata and events reveal about who paid whom for what? P3
1 Weak
Best evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Every card purchase is published onchain against the user's wallet, with its type, currency and amount and a stable wallet address, so anyone can rebuild a cardholder's spending history. The linkage is disclosed in the privacy policy, so 1.
Evidence (2)1 verified · 1 documented
Verified
Each card debit emits OutgoingTransactionProcessed with transaction and operation IDs, the plaintext type "Card-Debit-POS", fiat currency "EUR", amounts and the user's wallet; Accounts events carry the partner's parentEntity.
The privacy policy says public blockchain records hold wallet addresses, amounts and timestamps that can be linked to the user through off-chain records.
Which third parties see a request during a payment, and can they be swapped out? P4
1 Weak
Best evidence: DocumentedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Privy, the issuer, the card network, Crossmint, KYC and analytics vendors all see user or payment data. They are disclosed in the Terms and privacy policy (some only by category) and cannot be swapped. Disclosed in docs only, so 1.
Evidence (1)1 documented
Documented
The privacy policy names categories of recipients (identity verification, wallet infrastructure, blockchain infrastructure, card and payment partners, analytics); the Terms name Privy, Crossmint and the card issuers.
Can RPC and indexer URLs be changed, and is the indexer code public? P5
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Endpoints are hardcoded in the app and the indexer is closed. Hardcoded, so 0.
Evidence (1)1 documented
Documented
The API URL is baked in at build time and the Base chain is defined with https://mainnet.base.org as its RPC; the app exposes no setting to change either.
Who holds funds between payer and payee, and can the provider redirect them? S1
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Between the user's wallet and the merchant, funds move into Wirex's FundsBuffer, and the oracle can send them to any destination the admin EOA sets. The Terms call the wallet self-custodial and say Wirex cannot move user assets, while the installed executor lets Wirex's oracle move them. The provider can redirect funds, so 0.
Evidence (2)2 verified
Verified
processOutgoingTransaction (L293-L346) sends a wallet's tokens to FundsBuffer or to a destination set by configureTokenDestination (L1061-L1071, onlyAdmin); both are reachable only by Wirex EOAs.
Who can change the contract code, and with how much notice? S2
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
One EOA can upgrade every BaaS contract (implementations were redeployed around block 52.04M, days before this read) with no timelock. EOA admin, so 0.
Evidence (2)2 verified
Verified
The FundsManagement proxy's EIP-1967 admin is this ProxyAdmin, whose owner() is EOA 0x8b72904e3685448E6f890d65a15D2aA206C1e0ab; the Accounts, ExecutionDelayPolicy, TokensRegistry and FundsBuffer ProxyAdmins have the same owner.
How large an allowance does the SDK ask users to grant, and for how long? S3
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Onboarding gives the Wirex FundsManagement contract unlimited allowances on every supported token, and I found no user-facing disclosure. Unbounded, undisclosed, so 0.
Evidence (1)1 verified
Verified
USDC allowance(sample wallet 0x7a55A64c..., FundsManagement) is 2^256-1; the WUSD allowance is also unlimited. FundsManagement.setApprovalsForRegistryTokens (L146-L163) grants type(uint256).max on every registry token at onboarding.
If the provider disappears tomorrow, do payees keep their funds and the ability to keep settling? S4
0 Fails
Sets the pillar ratingBest evidence: VerifiedChecked 2026-10-19 today
UnreviewedAssessed by AI research agent (seed), 2026-10-07
Derived: S1 = 0 (the oracle and admin can move funds), C2 = 0, C3 = 0, O3 = 0. The contracts let a wallet owner withdraw through request-and-execute without Wirex's oracle, but the signing key is a Privy embedded wallet reached through the Wirex One app, and I could not verify an export path. Admin EOAs can also reclassify operations or upgrade the policy. Judgment call: access depends on the provider, so 0, not 1.
Evidence (1)1 verified
Verified
ERC-20 withdrawals use a request-then-execute pattern enforced by ExecutionDelayPolicy; the policy storage at block 52290735 gives a 3-second normal delay and a 1-day delay for account changes.
Are secrets kept out of client bundles and are webhooks signed and verified? S5
0 Fails
Sets the pillar ratingBest evidence: DocumentedChecked 2026-10-07 12 days ago
UnreviewedAssessed by AI research agent (seed), 2026-10-07
A client secret ships in the browser bundle. What it authorises was not tested and nothing was called with it. Secrets in client, no mitigation found, so 0.
Evidence (1)1 documented
Documented
The production web app config contains a literal OAuth client secret for the wirexone SSO client (redacted in the archive copy).
Has the code been audited at a pinned commit, were findings fixed traceably, and is there a live bounty? S6
? No evidence
Sets the pillar rating
UnreviewedAssessed by AI research agent (seed), 2026-10-07
No checkable evidence settles this yet, so it counts as 0.
Security audits 3
Published audits and similar reviews of this provider's code, newest first. Context for the Audits and bug bounty rating, which scores them; this list does not change any rating, and an audit of older code says little about what is deployed now.
Shared component: ZeroDev Kernel v3.0-to-3.x changes (incremental, the v3.1 release) plus WebAuthn, MultiChain WebAuthn and Weighted validators and the SpendingLimit hook Audit period 27 May-9 June 2024. Reviews only the diff from v3.0, so it relies on the ChainLight v3.0 audit for the rest of the account. Whether the sample wallet's implementation matches this code was not checked byte for byte.
Shared component: ZeroDev Kernel v3 KernelFactory and FactoryStaker at 85617952ec The file is named kalos_v3_plugins but its scope is the factory contracts.
Shared component: ZeroDev Kernel v3.0 (ERC-7579 smart account) core and validation modules at 8646f2c25f Audit started 11 March 2024 on kernel_v3 commits 5f086737 and 8646f2c2. Wirex wallets run Kernel v3.1, whose changes from v3.0 were reviewed separately in June 2024. Does not cover the Wirex executor module or BaaS contracts.
Partly
2 high, 2 medium, 3 low, 5 informational
Compiled from: The wirexapp GitHub organisation including wirex-baas-agent-skills (no audits/ folder or audit mention for the contracts), wirexapp.com, web searches for Wirex and Wirex Pay contract audits (Hacken, Halborn, CertiK, Zellic), and the audits/ folder of github.com/zerodevapp/kernel (main and release/v3.3) for the Kernel v3.1 smart account. No audit of the Wirex BaaS contracts on Base (ContractRegistry, FundsManagement, ExecutionDelayPolicy, FundsBuffer) is published. Audits of the ERC-4337 EntryPoint are not logged here. Checked 2026-10-13. Only published reports are listed; private audits a provider mentions without a report are not.
Operational and procurement
Facts an institution's procurement, finance and security functions ask for. Separate from the CROPS ratings and never scored.
Group A: operational facts. Group B: 45 due-diligence controls derived from a UN agency's vendor requirements: 10 evidenced, 0 attested, 11 absent, 0 not applicable, 24 unknown. "Not applicable" means there is no operator to hold the control: it falls to whoever deploys the rail. How to read this.
Group A: operational facts
Fees
Evidenced
Component
Paid by
Amount
Basis
fx
payer
card scheme or provider rate plus mark-up; amount not published
Wirex One Terms 9.10; the Fees and Limits Schedule they cite is not published.
network
payer
network gas on onchain transactions, set by the network
Wirex One Terms 4.6.
No Wirex One fee schedule is published: Terms 1.14 link it as "XXX". The help centre's general Wirex Fees article (help.wirexapp.com/article/wirex-fees-1379, client-rendered) lists card issuance free, ATM free up to 200 GBP/EUR a month then 2%, and card delivery from 5 GBP/EUR, but it does not name Wirex One and describes the classic Wirex account. Judgment call: those figures are not recorded as Wirex One fees, consistent with the availability judgment in the research log.
Documented
Wirex One Terms 9.10 (card transactions in another currency).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Custody model
Evidenced
Hybrid: self-custody with a provider-controlled spend path
Hybrid, not self-custody: funds sit in the user's Kernel smart account (key via Privy), but Wirex's FundsManagement executor is installed on it and Wirex's oracle EOA can move balances to FundsBuffer or an admin-set destination (S1 = 0, provider can redirect). The Terms call the wallet self-custodial.
Authorised Electronic Money Institution · 902025 Issue e-money and provide payment services; authorised since 17/08/2018. Provides Wirex One card services in the EEA, UK and rest of world.
Only Wirex Limited was checked in a register. Per the Terms, EEA and UK crypto-asset services are provided by Crossmint Europe, S.L. (Spain, CNMV crypto-asset service provider and Bank of Spain payment institution, partner) and the card in Australia and New Zealand by Novatti Group Limited (partner); neither was checked in its regulator's register. UAB Wirex does EEA card programme management and has no entry in the Bank of Lithuania register.
Documented
FCA Register firm page for reference 902025 (client-rendered; text read in a browser and archived), Companies House number 09334596.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Cash-out options
Evidenced
Where
Method
Partner
Fee
Limits
everywhere offered
card withdrawal
Wirex Limited (Novatti in AU and NZ), Visa or Mastercard
FX mark-up not published
Card spend at merchants from the smart-account balance (the schema has no card-spend value); limits not published.
everywhere offered
atm
Wirex Card
not published for Wirex One
ATM withdrawals need the card PIN; limits not published.
everywhere offered
bank transfer
Wirex and regulated third-party providers (account identifiers)
not published for Wirex One
Virtual IBANs, sort codes or other local details; SEPA, Faster Payments or ACH depending on the account identifier.
No first-party country list exists for Wirex One (see the research log, Availability 2026-10-09), so ALL is the unbounded set of supported jurisdictions, not a published list. The Terms also offer Pay-to-Card transfers to external Visa or Mastercard cards (9.14). Which rails each region gets is not stated.
Documented
Wirex One Terms 1.8 to 1.11 (card providers per region) and clause 9 (Wirex Card).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
First deployment
Evidenced
2025-04-29 (block 29552868): FundsManagement proxy 0xFB384a73...F06a on Base (card debits), part of the shared Wirex BaaS deployment
Dates the BaaS settlement contracts scored in CROPS. Wirex One itself replaced the legacy Wirex app later (the status page logs a legacy-to-Wirex One balance migration in June 2026); the legacy Wirex card and Wirex Pay chain predate this and are excluded.
Verified
FundsManagement proxy has code size 0 at block 29552867 and 1159 at 29552868 (2025-04-29 02:51:23 UTC); creation tx 0xb85fdeb6...471a from 0x685f0df57331bE2Ff7306415Fe4f36F610c80e54 (receipt contractAddress matches; Sourcify deployment record agrees). FundsBuffer 0xbFACe6Ad... was created 69 blocks earlier (29552799).
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Security incidents
Evidenced
2026-06-25: Card operations incident; to contain it, all card transactions were set to be declined in all regions (status page, critical; follow-up outage entry on 26 June). funds lost: unknownsource
2026-09-03: Major incident affecting all financial operations on Wirex One; stuck transactions to be processed after the fix (status page, critical). funds lost: unknownsource
2026-09-30: Card operations stopped temporarily in all regions after a problem during planned maintenance at a third-party provider (status page, critical). funds lost: unknownsource
Absence of a found incident is not evidence that none occurred.
Selected from status page incidents marked critical since the Wirex One rollout (May 2026); the API returns the 50 most recent incidents back to 2024-04-17. Major-level Wirex One incidents (bank transfers 2026-08-27, deposits 2026-09-16, exchange 2026-09-26) are not listed. No funds loss was stated in any update.
Documented
Status page incident, Card operations outage, June 2026.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Product changes affecting users
Evidenced
2018-08-17: Wirex Limited authorised by the FCA as an Electronic Money Institution (FRN 902025). source
2026-06-29: Balances migrating from the legacy Wirex app to Wirex One (status page incident on migration failures from 28 June). source
2026-09-30: EEA card transactions before 30 September 2026 fall under TRANSACT Payments Malta Limited's terms; the current Terms name Wirex Limited as the EEA card service provider. source
Judgment call: the 30 September 2026 entry reads clause 13.7 together with clause 1.8 as a change of EEA card provider; the Terms do not state the change in so many words.
checked 2026-10-09 · source unchanged at weekly re-read 2026-10-19
UnreviewedAssessed by AI research agent (operational), 2026-10-09Checked 2026-10-09
Volume transacted (verified only)
Not observable
Card debits are OutgoingTransactionProcessed events on the shared Wirex BaaS FundsManagement contract, which serves several partner programmes (UserAccountCreated parentEntity values vary) and also processes non-card outgoing operations; the event's operation type is a string the spec cannot filter, and nothing onchain ties a wallet to the Wirex One programme without Wirex's records.
UnreviewedAssessed by AI research agent (operational), 2026-10-09
Group B: institutional due diligence
Control
State
What was found
Assurance and certifications
B1.1 ISO 27001, developer organisation Is the organisation that develops the product ISO 27001 certified, and does the certificate name that entity?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.2 ISO 27001, hosting and support organisation Is the organisation that hosts and supports the service ISO 27001 certified in its own name, with a scope covering the service?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.3 SOC 2 Type II or ISAE 3000/3402 reports Does the provider undergo periodic SOC 2 Type II or ISAE 3402 Type II assessments and make reports available?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.4 Independent source-code security review before go-live Was the application reviewed by an independent party before launch, and is the report linked?
Unknown
No audit or independent review of the Wirex BaaS contracts, API or app was found (CROPS S6 unknown); several implementations are only partial Sourcify matches and the TokensRegistry implementation is unverified.
B1.5 Penetration testing Is the service penetration-tested before go-live and at least every three years, with results available?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B1.6 Vulnerability scanning cadence Are the platform and the application scanned for vulnerabilities at least every six months?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Vulnerability and patch management
B2.1 Security contact and disclosure policy Is there a published way to report a vulnerability (SECURITY.md, security.txt, or a disclosure page)?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no security policy file source 1
B2.2 Patch service levels Does the provider commit to patch timelines for known vulnerabilities (the partner expects 30 days critical, 40 high, 90 medium)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B2.3 Dependency and vulnerability scanning in CI Do the public repositories run dependency or code scanning automatically?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no scanning config or workflow step found source 1
Incident reporting and continuity
B3.1 Incident reporting commitment Does the provider commit to notify customers of security or data incidents within a stated time (the partner expects 24 hours)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.2 Backups and restore testing Are customer records backed up daily and restores tested on a schedule?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.3 Recovery plan Is there an approved and tested recovery plan for the service?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B3.4 Status page and post-mortems Does the provider publish service status and post-mortems for incidents?
Evidenced
Public status page at status.wirexapp.com (Atlassian Statuspage) with incident histories, including WirexOne-labelled incidents. No post-mortem was found among the 50 most recent incidents (2024-04-17 to 2026-10-08) returned by its API. source 1 · source 2
Identity and access (operator side)
B4.1 MFA for end users Can or must end users protect accounts with multi-factor authentication?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.2 MFA and separate accounts for privileged access Is privileged access protected by MFA and kept on separate accounts?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.3 Periodic access reviews Are user access rights reviewed at least annually and privileged accounts at least six-monthly?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.4 Segregation of duties and joiner-mover-leaver controls Is there a documented segregation-of-duties model and a joiner-mover-leaver process?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B4.5 Session timeout Are idle interactive sessions terminated after a defined period (the partner expects 60 minutes)?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
API and integration
B5.1 API authentication, browser to server Which standard (OAuth 2.0, OpenID Connect, SAML, JWT) protects browser-to-server API calls?
Evidenced
Retail users authenticate through Privy (access and identity tokens exchanged for a Wirex user token); partner backends use OAuth2 client credentials. All tokens are HMAC-SHA256 signed JWTs. source 1
B5.2 API authentication, server to server Are server-to-server calls authenticated with keys or PKI certificates, and are keys scoped and rotatable?
Evidenced
Server-to-server calls use OAuth2 client credentials (client_id and client_secret issued by Wirex) with a single scope, partner:full; rotation is not documented. The Wirex One web bundle ships a literal SSO client secret (CROPS S5). source 1 CROPS S5
B5.3 Token expiry Do API tokens expire, and within what period (the partner caps it at 120 minutes for public data, 30 otherwise)?
Evidenced
Access tokens (S2S and user) are valid for 48 hours, far above the partner's 120-minute cap. source 1
B5.4 Export controls If an API exports data, does it limit volumes and log exports?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Data protection and privacy governance
B6.1 Data classification and encryption Does the provider state a data classification and enforce encryption at rest and TLS 1.2 or better in transit?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B6.2 Production data kept out of test environments Does the provider state that production or real personal data is not used in development and testing?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B6.3 Data retention and deletion on termination What is retained, for how long, and is customer data removed on termination?
Evidenced
Customer account records are normally kept up to six years after the relationship ends; legacy Wirex App records may be kept separately; public blockchain records cannot be deleted (see CROPS P2 for what is collected). source 1 CROPS P2
B6.4 Data protection impact assessment and roles For systems holding personal data, has a DPIA been completed and are controller and processor defined?
Evidenced
The controller is the Wirex group company that provides the service under the Terms; requests from EEA Wirex One users are routed to Wirex Europe sp. z o.o. as controller during the transition, and partners providing regulated services may be independent controllers. DPIA availability not found. source 1 · source 2
B6.5 Data processing or sharing agreement available Can a customer obtain a data processing agreement or equivalent?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Logging and monitoring
B7.1 Audit logging Are account changes, logins and activity on important records logged and retained?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B7.2 Central monitoring and endpoint detection Are logs sent to a managed SIEM and is endpoint detection running on all platforms?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Hosting and network
B8.1 Hardened hosting Are hosts hardened to a recognised benchmark, with only essential ports open, IDS/IPS, a WAF for internet-facing applications and tenant isolation?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B8.2 Deployment configuration and infrastructure as code Does the repository ship reproducible deployment configuration (containers, IaC, Helm) that a self-hoster can harden?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no deployment configuration source 1
Engineering practice in public repositories
B9.1 Default branch protected Does the default branch require reviews and passing checks, with no direct pushes?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no branch rules visible (classic branch protection is not readable without push access) source 1
B9.2 CI runs on pull requests Does every pull request trigger automated checks?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no .github/workflows source 1
B9.3 Tests run in CI Do the CI workflows run the test suite?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ test command in a workflow source 1
B9.4 Coverage reported Is test coverage measured and reported (the partner expects 85%)?
B9.5 Versioned releases Are releases tagged with immutable semantic versions?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no tags source 1
B9.6 Signed tags or commits Are release tags or recent commits cryptographically signed?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ 0 of 1 recent commits signed source 1
B9.7 Changelog Is a changelog maintained with the code?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ no changelog or release notes source 1
B9.8 Contribution and branching model documented Does the README or contribution guide state how changes are proposed, reviewed and released?
Absent
none of 1 repo(s): wirexapp/wirex-baas-agent-skills ✗ none found source 1
Architecture documentation
B10.1 Architecture documentation Is there a public architecture document covering logical, infrastructure and integration architecture and the components used?
Evidenced
Integration architecture is published for Wirex BaaS (REST API with OAuth2, contract registry, Account Abstraction wallets, card, KYC and banking modules); logical contract architecture is partly covered by ABI fragments; infrastructure architecture is not published. source 1
Commercial and financial
B11.1 Contracting entity Which legal entity would an institution contract with, and in which jurisdiction?
Evidenced
Card-based services in the EEA, UK and rest of world are provided by Wirex Limited (England and Wales, 09334596); UAB Wirex (Lithuania, 305118023) runs EEA card programme management; Crossmint Europe, S.L. provides EEA and UK crypto-asset services; Novatti Group Limited provides the card in Australia and New Zealand. UAB Wirex, Crossmint Europe and Novatti were not checked in their company registers; UAB Wirex returns no entry in the Bank of Lithuania's register of financial market participants. source 1 · source 2
B11.2 Funding of ongoing operation How is ongoing operation and maintenance funded (revenue, foundation, grants, fee switch), per a primary source?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
B11.3 Termination terms What happens to customer funds and data on termination by either side?
Evidenced
The user may close the Wirex Profile at any time (closure can be delayed by investigations); Wirex may terminate with at least two months' notice, or suspend or terminate earlier for breach, suspected fraud or legal reasons. Closure ends regulated services only; the self-custodial wallet stays with the user. CROPS S1 and S4 found that Wirex's oracle can move wallet balances through the installed executor module, so the Terms' description of sole control does not match the deployed contracts. source 1 · source 2
AI components
B12.1 AI in the payment path Does an AI system take part in payment processing or compliance decisions (for example automated transaction screening)?
Evidenced
Yes: application decisions may be made solely by automated checks, and accounts are profiled for a risk rating used in fraud and transaction monitoring; wallet-address screening and blockchain monitoring apply to Wirex One. Whether AI or machine learning is used is not stated. source 1
B12.2 AI controls documented If AI is used, are monitoring, validation, override, decommissioning and bias evaluation documented?
Unknown
No first-party statement found in the documents listed in the research log (Operational 2026-10-09).
Scope of assessment
Components in the payment path
Component
Role
Public
Licence
Operator
Required
Wirex BaaS contracts on Base (registry, FundsManagement, policies)
contracts
Yes
none
Wirex (owner EOA 0x8b72...e0ab)
Yes
Kernel v3.1 smart account (ZeroDev)
wallet
Yes
MIT
user, with Wirex executor module installed
Yes
Wirex One app (web and mobile)
frontend
No
proprietary
Wirex
Yes
Wirex BaaS API (api-baas.wirexapp.com)
backend
No
proprietary
Wirex
Yes
FundsManagementOracle (EOA that executes card debits)
signer
No
proprietary
Wirex
Yes
Privy key management (user signer)
signer
No
proprietary
Privy
Yes
ERC-4337 bundler and paymaster (operator for Base not identified)
bundler
No
proprietary
undisclosed (repo docs show bundler.wirexpay.com for Polygon)
Yes
Card issuer (Wirex Limited; Novatti in AU/NZ)
card-issuer
No
proprietary
Wirex Limited, Novatti Group
Yes
Visa or Mastercard
card-network
No
proprietary
Visa, Mastercard
Yes
Identity verification provider (not named)
kyc
No
proprietary
undisclosed
Yes
Crossmint Europe (EEA crypto-asset services, SEPA off-ramp)
other
No
proprietary
Crossmint Europe S.L.
No
Web app analytics (Sentry, Amplitude, Google Tag Manager, GrowthBook)
Wirex One (launched May 2026; replaced crypto in the classic Wirex app for EEA and AU users) runs on Wirex's BaaS stack on Base: Kernel v3.1 smart accounts with a Wirex FundsManagement executor and an ExecutionDelayPolicy. The link comes from the one.wirexapp.com production bundle (archived and redacted in data/archive/wirex-one-web-app-config.txt) together with Wirex's own BaaS repo, which publishes the Base registry. The legacy Wirex Pay chain (chain 31415, a Polygon CDK validium with "Card" contracts verified on its Blockscout) is not assessed: it is not in the dashboard RPC list and showed only bridge transactions in Sep-Oct 2026. The web bundle also contains an SSO client secret; it was not used.
